SQL databases should have vulnerability findings resolved
Monitor vulnerability assessment scan results and recommendations for how to remediate database vulnerabilities. The powerpipe check sql_database_vulnerability_findings_resolved is titled "SQL databases should have vulnerability findings resolved".
Monitor vulnerability assessment scan results and recommendations for how to remediate database vulnerabilities.
What this control checks
SQL databases should have vulnerability findings resolved, per vulnerability assessment scan.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.sql_database_vulnerability_findings_resolved.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-08 (Systems, hardware, software, services, and data are managed throughout their life cycles.).
Framework mappings
The clauses this control is mapped to in each framework.
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 1 IT Governance
- 3.3 Vulnerability Management
- RA-5 Vulnerability Scanning
- SI-2 Flaw Remediation
- 0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management
- 0716.10m3Organizational.1-10.m 10.06 Technical Vulnerability Management
- 6.6 For public-facing web applications, ensure that either one of the requirements are in place
- 11.2.1: Perform quarterly internal vulnerability scans and rescans as needed, until all "high-risk" vulnerabilities (as identified in Requirement 6.1) are resolved. Scans must be performed by qualified personnel.
- Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor- supplied security patches
- For a sample of system components including all operating system types commonly affected by malicious software, verify that anti-virus software is deployed if applicable anti-virus technology exists
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_vulnerability_findings_resolved - Powerpipe Control:
azure_compliance.control.sql_database_vulnerability_findings_resolved
Last reviewed: 2026-10-15